Wells Fargo & Co. raised its estimate for how many bogus accounts employees may have created, a sign the bank is still struggling to move past a scandal that sparked record fines and congressional investigations.

An outside review into more than 165 million deposit and credit-card accounts found an additional 1.4 million that were potentially unauthorized, bringing the total to about 3.5 million, according to a statement Thursday from the San Francisco-based firm. The revised estimate covers January 2009 to September 2016, almost twice as long as the period examined in the initial review.

The disclosure of even more fraudulent accounts threatens to catapult Wells Fargo back into the political crosshairs just as Congress returns Sept. 5 from its summer recess. The scandal came to light almost a year ago after regulators slapped Wells Fargo with fines of $185 million over its sales practices, prompting congressional hearings and resulting in the bank naming new leaders, clawing back executives’ pay and beginning an overhaul of its retail division.

“New data should cause some lawmakers to re-engage on the issue,” Isaac Boltansky, an analyst with Compass Point Research & Trading, said before the new tally was announced. Democrats will again argue it proves Washington needs to keep rules tight on financial firms, while Republicans will continue to fault Consumer Financial Protection Bureau officials for not spotting the misconduct themselves, Boltansky said.

Expanded Review

Wells Fargo expanded its review after Washington lawmakers lambasted the company following former Chief Executive Officer John Stumpf’s testimony last September about the bank’s sales practices. Under pressure, the bank agreed to review records dating back to 2009, rather than through 2011 as it initially did.

The company said it has paid or identified $10.7 million in customer compensation related to the investigation. The figure includes $7 million of refunds, up from $3.3 million the bank had previously disclosed. It also includes $3.7 million related to what it described as the “complaints process/mediation.”

“There’s never just one cockroach in the kitchen,” Berkshire Hathaway Inc. CEO Warren Buffett, whose firm is the largest shareholder in Wells Fargo, said Wednesday in an interview on CNBC. “Anytime you put the focus on an organization that has hundreds of thousands of people working for it, you may very well find it wasn’t just the one that misbehaved.”

Online Service

The expanded review also uncovered about 528,000 potentially unauthorized online bill-pay enrollments, highlighting users with only one “minimal” payment and no further use of the service. “The analysis did not definitively identify whether an enrollment was authorized by a customer or not, and properly authorized enrollments are likely part of this total,” Wells Fargo said in the statement, adding that affected customers will be refunded $910,000 for related fees and charges.

“Today’s announcement is a reminder of the disappointment that we caused to our customers and stakeholders,” CEO Tim Sloan said on a conference call Thursday with reporters. “We apologize to everyone who was harmed by unacceptable sales practices that occurred in our retail bank.”

The company has no other reviews under way and isn’t planning additional ones, allowing it to focus on making refunds to customers, according to Oscar Suris, a spokesman. Sloan said no additional Wells Fargo workers will be fired in the wake of the new findings.

Shares of the company, which have dropped 7.2 percent this year, declined 0.4 percent to $51.17 at 9:58 a.m. in New York trading.

Democrats led by Representative Maxine Waters of California earlier this month called for a House Financial Services Committee hearing about a separate scandal at Wells Fargo involving unwanted car insurance imposed on auto-loan customers. And Senator Elizabeth Warren of Massachusetts wrote to the Federal Reserve to again press for the removal of board members who served during the original accounts review period of 2011 to 2015.

Wells Fargo has worked to minimize the impact of the new tally, describing the additional accounts as those it couldn’t rule out from lacking customer authorization. Sloan said the company erred on the side of its customers during the review, so the figures might include some accounts that were properly authorized.

When it fined Wells Fargo last year, the CFPB ordered the bank to identify all customers affected by its sales misconduct and set aside $5 million for those harmed.

The new review doesn’t go back as far as 2002, the year that executives first knew about the sales misconduct and fired employees over it, according to investigators hired by the company’s board. Lawyers representing customers who said they were harmed by the bank’s abusive sales practices claimed in a lawsuit, known as Jabbari v Wells Fargo, that bank employees probably created 3.5 million bogus accounts starting in May 2002. Wells Fargo is awaiting final approval to settle that case for $142 million.

“We’re very comfortable that the amount of the Jabbari settlement is more than sufficient to address the needs of our current and former customers,” Sloan said on the call.